CLAIMS 



What is claimed is: 



1 . A method of reconstructing ia session using a first analyzer coupled to a second 
ianalyzer and a data collector, the method comprising: 

performing session reconstruction analysis on packets received at the first analyzer; 
responsive to successful session reconstruction on the first analyzer, sending a first 
message to at least one of the second analyzer and the data collector, the first 
message corresponding to session data; and 



responsive to unsuccess 
more messages to the 
more messages fi:'om 



1 session reconstruction on the first analyzer, sending one or 
second analyzer, the second analyzer also receiving one or 
a third analyzer. 



1 2. The method of claim 1 , wnirein the one or more messages from the first analyzer to 

2 the second analyzer ccpnprise pacWets received by the first analyzer. 

1 3. The method of claim 2, wherein the one or more messages from the first analyzer to 

2 the second analyzer fiirther comprjfse hints generated by the first analyzer. 

1 4. The method of claim 3, wnerein hints for a packet comprise a time the packet was 

2 received and an address information for the packet. 

1 5. The method of claim 1, wherein the packets received at the first analyzer are output 

2 from a filter for controlling whjfch packets in a plurality of packets flowing into the filter reach 

3 the first analyzer. 
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The method of claim 1, furthetf comprising: 

performing session reconstruction analysis on the one or more messages received at 
the second analyzer; 

responsive to successful session reconstruction on the second analyzer, sending a first 
message to at least one off a fourth analyzer and the data collector, the first 
message corresponding p session data; and 

responsive to unsuccessful session reconstruction on the second analyzer, sending one 
or more messages to th^ fourth analyzer, the fourth analyzer also receiving one or 



more messages from a 



the second analyzer comprise si 



ifth analyzer. 



7. The method of claim 1 , wHerein the one or more messages from the first analyzer to 



lary of packets received by the first analyzer and one or 



3 more hints generated by the first/analyzer. 

"^1 8. The method of claim 1 , mrther comprising performing session reconstruction using 

2 the second analyzer on the oneJor more messages received from the first analyzer and the one 

3 or more messages received from the third analyzer. 

1 9. The method of claimf 8, further comprising sending a second message from the second 

2 analyzer to the data collector, the second message corresponding to session data. 



1 10. 
2 
3 
4 



A system for reconstructing a session, the system comprising: 

a plurality of packet sources, each of the plurality of packet sources generating a 



plurality of p; 
a first analyzer; 



Lckets; 
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5 a plurality of analyzers, each of thp plurality of analyzers coupled to a packet source in 

6 the plurality of packet sources, each of the plurality of analyzers for session 

7 reconstruction on respectiveroackets in the corresponding packet source, each of 

8 the plurality of analyzers sending a first message corresponding to session data for 

9 reconstructed sessions to the first analyzer and a second message for 

10 unreconstructed session data in the respective packets to the first analyzer, 

1 1 and wherein the first analyzer responsive to receiving messages fi-om the plurality of 

12 analyzers attempts session reconstlfuction using the messages. 

~ 1 12. The system of claim 1 1 Avherein the second message further comprises hints. 

B I 

I 3 / 

J! 1 13. The system of claim yO wherein the second message comprises summary of respective 

O / 

^ 2 packets and hints. / 
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